ENKI describes a Kimsuky-linked spearphishing operation that abused GitHub and Dropbox as malware delivery and collection infrastructure. The malware used hardcoded GitHub Personal Access Tokens with repo scope to access private repositories, download RTF-named payloads, and upload victim logs. The payloads decompressed into XenoRAT-based .NET malware, with C2 addresses including 158.247.230.196:443, 216.244.74.115:80, and 165.154.78.9:443. Decoy documents impersonated South Korean legal, financial, administrative, and traffic-related notices, while logs captured host details, running processes, boot-time data, webpage titles, and keystrokes. The report links the activity to Kimsuky through XenoRAT C2 analysis and repository evidence, showing how attacker-controlled GitHub infrastructure supported targeted South Korean spearphishing.